logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0004-Avoid-implicit-pointer-sign-conversions.patch (32126B)

    

  1. From 44bc6dfcdd2581f64fc869c8863dd590ea947033 Mon Sep 17 00:00:00 2001
  2. From: Michael Forney <mforney@mforney.org>
  3. Date: Thu, 2 Apr 2026 23:52:53 -0700
  4. Subject: [PATCH] Avoid implicit pointer sign conversions
  6. s_client_options:
  7. All option values for clr and off used here fit in a 32-bit int,
  8. the largest being SSL_OP_NO_TLSv1_3=0x20000000L, so make these
  9. fields int.
  11. sm4_ctr_cipher:
  12. CRYPTO_ctr128_encrypt expects an unsigned int *, but ctx->num is
  13. an int. Use a local variable with the correct type to avoid aliasing
  14. issues.
  16. addr_validate_path_internal:
  17. length is used twice, its address is passed to
  18. IPAddressFamily_afi_length, expecting an int *, and addr_contains, also
  19. expecting int, so change its type to int.
  21. tls_decrypt_ticket:
  22. hlen is used for the result of HMAC_size. Though the manual documents
  23. this as returning a size_t, it actually returns an int since it
  24. wraps EVP_MD_size, which can return a negative value. HMAC_Final
  25. expects an unsigned int *, so we need a separate variable for the
  26. final length.
  28. tls13_new_session_ticket_recv:
  29. session_id_length is used twice, its address is passed to EVP_Digest
  30. which expects an unsigned int, and then it is saved in
  31. SSL_SESSION.session_id_length, a size_t. So its type from int to
  32. unsigned int.
  34. All other changes simply make explicit the conversions among pointers
  35. to character types already being done. These implicit conversions
  36. are constraint violations in ISO C.
  37. ---
  38.  apps/openssl/ca.c              |  7 ++++---
  39.  apps/openssl/cms.c             |  2 +-
  40.  apps/openssl/s_client.c        |  4 ++--
  41.  crypto/asn1/a_object.c         | 12 ++++++------
  42.  crypto/asn1/a_time.c           |  2 +-
  43.  crypto/asn1/a_time_tm.c        | 22 ++++++++++++----------
  44.  crypto/bio/b_dump.c            |  2 +-
  45.  crypto/bio/bss_mem.c           |  4 ++--
  46.  crypto/bn/bn_convert.c         |  8 ++++----
  47.  crypto/bn/bn_print.c           |  2 +-
  48.  crypto/evp/e_sm4.c             |  4 +++-
  49.  crypto/ocsp/ocsp_cl.c          |  4 ++--
  50.  crypto/pkcs7/pk7_attr.c        |  2 +-
  51.  crypto/x509/x509_addr.c        |  2 +-
  52.  crypto/x509/x509_constraints.c | 18 +++++++++---------
  53.  crypto/x509/x509_obj.c         | 10 +++++-----
  54.  crypto/x509/x509_utl.c         |  8 ++++----
  55.  crypto/x509/x509_verify.c      |  3 ++-
  56.  crypto/x509/x509name.c         |  3 ++-
  57.  ssl/s3_lib.c                   |  2 +-
  58.  ssl/ssl_clnt.c                 |  2 +-
  59.  ssl/ssl_lib.c                  |  8 ++++----
  60.  ssl/ssl_srvr.c                 |  2 +-
  61.  ssl/ssl_tlsext.c               |  3 ++-
  62.  ssl/ssl_txt.c                  |  4 ++--
  63.  ssl/t1_lib.c                   |  4 +++-
  64.  ssl/tls13_client.c             |  8 ++++----
  65.  ssl/tls13_key_schedule.c       | 12 ++++++------
  66.  ssl/tls13_legacy.c             |  2 +-
  67.  ssl/tls13_lib.c                |  3 ++-
  68.  ssl/tls13_record_layer.c       |  2 +-
  69.  ssl/tls13_server.c             | 10 +++++-----
  70.  32 files changed, 96 insertions(+), 85 deletions(-)
  72. diff --git a/apps/openssl/ca.c b/apps/openssl/ca.c
  73. index a2e8a6836..5505983ff 100644
  74. --- a/apps/openssl/ca.c
  75. +++ b/apps/openssl/ca.c
  76. @@ -2197,7 +2197,7 @@ do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
  77.  
  78.  	if ((tm = X509_get_notAfter(ret)) == NULL)
  79.  		goto err;
  80. -	row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
  81. +	row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
  82.  	    ASN1_STRING_length(tm));
  83.  	if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
  84.  		BIO_printf(bio_err, "Memory allocation failure\n");
  85. @@ -2325,7 +2325,7 @@ do_revoke(X509 *x509, CA_DB *db, int type, char *value)
  86.  
  87.  		if ((tm = X509_get_notAfter(x509)) == NULL)
  88.  			goto err;
  89. -		row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
  90. +		row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
  91.  		    ASN1_STRING_length(tm));
  92.  		if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
  93.  			BIO_printf(bio_err, "Memory allocation failure\n");
  94. @@ -2489,7 +2489,8 @@ do_updatedb(CA_DB *db)
  95.  		cnt = -1;
  96.  		goto err;
  97.  	}
  98. -	a_tm_s = strndup(ASN1_STRING_get0_data(a_tm), ASN1_STRING_length(a_tm));
  99. +	a_tm_s = strndup((char *)ASN1_STRING_get0_data(a_tm),
  100. +	    ASN1_STRING_length(a_tm));
  101.  	if (a_tm_s == NULL) {
  102.  		cnt = -1;
  103.  		goto err;
  104. diff --git a/apps/openssl/cms.c b/apps/openssl/cms.c
  105. index 7430f4c93..a63d6e453 100644
  106. --- a/apps/openssl/cms.c
  107. +++ b/apps/openssl/cms.c
  108. @@ -1512,7 +1512,7 @@ cms_main(int argc, char **argv)
  109.  			cfg.secret_keyid = NULL;
  110.  		}
  111.  		if (cfg.pwri_pass != NULL) {
  112. -			pwri_tmp = strdup(cfg.pwri_pass);
  113. +			pwri_tmp = (unsigned char *)strdup((char *)cfg.pwri_pass);
  114.  			if (pwri_tmp == NULL)
  115.  				goto end;
  116.  			if (CMS_add0_recipient_password(cms, -1, NID_undef,
  117. diff --git a/apps/openssl/s_client.c b/apps/openssl/s_client.c
  118. index 2b05facc1..d12423d0f 100644
  119. --- a/apps/openssl/s_client.c
  120. +++ b/apps/openssl/s_client.c
  121. @@ -194,7 +194,7 @@ static struct {
  122.  	char *cert_file;
  123.  	int cert_format;
  124.  	char *cipher;
  125. -	unsigned int clr;
  126. +	int clr;
  127.  	char *connect;
  128.  	int crlf;
  129.  	int debug;
  130. @@ -215,7 +215,7 @@ static struct {
  131.  	int nbio_test;
  132.  	int no_servername;
  133.  	char *npn_in;
  134. -	unsigned int off;
  135. +	int off;
  136.  	char *passarg;
  137.  	int peekaboo;
  138.  	char *port;
  139. diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
  140. index 333ac6034..25e7a2ae6 100644
  141. --- a/crypto/asn1/a_object.c
  142. +++ b/crypto/asn1/a_object.c
  143. @@ -182,7 +182,7 @@ oid_add_arc_txt(CBB *cbb, uint64_t arc, int first)
  144.  	n = snprintf(s, sizeof(s), fmt, (unsigned long long)arc);
  145.  	if (n < 0 || (size_t)n >= sizeof(s))
  146.  		return 0;
  147. -	if (!CBB_add_bytes(cbb, s, n))
  148. +	if (!CBB_add_bytes(cbb, (uint8_t *)s, n))
  149.  		return 0;
  150.  
  151.  	return 1;
  152. @@ -343,7 +343,7 @@ a2d_ASN1_OBJECT(unsigned char *out, int out_len, const char *in, int in_len)
  153.  	if (in_len <= 0)
  154.  		goto err;
  155.  
  156. -	CBS_init(&cbs, in, in_len);
  157. +	CBS_init(&cbs, (uint8_t *)in, in_len);
  158.  
  159.  	if (!CBB_init(&cbb, 0))
  160.  		goto err;
  161. @@ -401,7 +401,7 @@ i2t_ASN1_OBJECT_name(const ASN1_OBJECT *aobj, CBB *cbb, const char **out_name)
  162.  
  163.  	*out_name = name;
  164.  
  165. -	if (!CBB_add_bytes(cbb, name, strlen(name)))
  166. +	if (!CBB_add_bytes(cbb, (uint8_t *)name, strlen(name)))
  167.  		return 0;
  168.  
  169.  	/* NUL terminate. */
  170. @@ -448,7 +448,7 @@ i2t_ASN1_OBJECT_internal(const ASN1_OBJECT *aobj, char *buf, int buf_len, int no
  171.  	if (!CBB_finish(&cbb, &data, &data_len))
  172.  		goto err;
  173.  
  174. -	ret = strlcpy(buf, data, buf_len);
  175. +	ret = strlcpy(buf, (char *)data, buf_len);
  176.   err:
  177.  	CBB_cleanup(&cbb);
  178.  	free(data);
  179. @@ -474,7 +474,7 @@ t2i_ASN1_OBJECT_internal(const char *oid)
  180.  
  181.  	memset(&cbb, 0, sizeof(cbb));
  182.  
  183. -	CBS_init(&cbs, oid, strlen(oid));
  184. +	CBS_init(&cbs, (uint8_t *)oid, strlen(oid));
  185.  
  186.  	if (!CBB_init(&cbb, 0))
  187.  		goto err;
  188. @@ -521,7 +521,7 @@ i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *aobj)
  189.  	if (!CBB_finish(&cbb, &data, &data_len))
  190.  		goto err;
  191.  
  192. -	ret = BIO_write(bp, data, strlen(data));
  193. +	ret = BIO_write(bp, data, strlen((char *)data));
  194.  
  195.   err:
  196.  	CBB_cleanup(&cbb);
  197. diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c
  198. index 3deff56ed..10634c067 100644
  199. --- a/crypto/asn1/a_time.c
  200. +++ b/crypto/asn1/a_time.c
  201. @@ -99,7 +99,7 @@ ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
  202.  	time_t now;
  203.  
  204.  	if (s != NULL)
  205. -		return ASN1_time_parse(s->data, s->length, tm, 0) != -1;
  206. +		return ASN1_time_parse((char *)s->data, s->length, tm, 0) != -1;
  207.  
  208.  	time(&now);
  209.  	memset(tm, 0, sizeof(*tm));
  210. diff --git a/crypto/asn1/a_time_tm.c b/crypto/asn1/a_time_tm.c
  211. index dd2893167..c0e0d6245 100644
  212. --- a/crypto/asn1/a_time_tm.c
  213. +++ b/crypto/asn1/a_time_tm.c
  214. @@ -96,7 +96,7 @@ tm_to_gentime(struct tm *tm, ASN1_TIME *atime)
  215.  	}
  216.  
  217.  	free(atime->data);
  218. -	atime->data = time_str;
  219. +	atime->data = (unsigned char *)time_str;
  220.  	atime->length = GENTIME_LENGTH;
  221.  	atime->type = V_ASN1_GENERALIZEDTIME;
  222.  
  223. @@ -122,7 +122,7 @@ tm_to_utctime(struct tm *tm, ASN1_TIME *atime)
  224.  	}
  225.  
  226.  	free(atime->data);
  227. -	atime->data = time_str;
  228. +	atime->data = (unsigned char *)time_str;
  229.  	atime->length = UTCTIME_LENGTH;
  230.  	atime->type = V_ASN1_UTCTIME;
  231.  
  232. @@ -293,7 +293,7 @@ ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode)
  233.  	if (bytes == NULL)
  234.  		return -1;
  235.  
  236. -	CBS_init(&cbs, bytes, len);
  237. +	CBS_init(&cbs, (uint8_t *)bytes, len);
  238.  
  239.  	if (CBS_len(&cbs) == UTCTIME_LENGTH)
  240.  		type = V_ASN1_UTCTIME;
  241. @@ -401,7 +401,8 @@ ASN1_TIME_check(const ASN1_TIME *t)
  242.  {
  243.  	if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
  244.  		return 0;
  245. -	return t->type == ASN1_time_parse(t->data, t->length, NULL, t->type);
  246. +	return t->type == ASN1_time_parse((char *)t->data, t->length, NULL,
  247. +	   t->type);
  248.  }
  249.  LCRYPTO_ALIAS(ASN1_TIME_check);
  250.  
  251. @@ -414,7 +415,7 @@ ASN1_TIME_to_generalizedtime(const ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
  252.  	if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
  253.  		goto err;
  254.  
  255. -	if (t->type != ASN1_time_parse(t->data, t->length, &tm, t->type))
  256. +	if (t->type != ASN1_time_parse((char *)t->data, t->length, &tm, t->type))
  257.  		goto err;
  258.  
  259.  	if (out == NULL || (agt = *out) == NULL)
  260. @@ -460,7 +461,7 @@ ASN1_TIME_cmp_time_t_internal(const ASN1_TIME *s, time_t t2, int mode)
  261.  	 * one of those pervasive things from OpenSSL we must continue with.
  262.  	 */
  263.  
  264. -	if (ASN1_time_parse(s->data, s->length, &tm1, mode) == -1)
  265. +	if (ASN1_time_parse((char *)s->data, s->length, &tm1, mode) == -1)
  266.  		return -2;
  267.  
  268.  	if (!asn1_time_time_t_to_tm(&t2, &tm2))
  269. @@ -480,10 +481,10 @@ ASN1_TIME_compare(const ASN1_TIME *t1, const ASN1_TIME *t2)
  270.  	if (t2->type != V_ASN1_UTCTIME && t2->type != V_ASN1_GENERALIZEDTIME)
  271.  		return -2;
  272.  
  273. -	if (ASN1_time_parse(t1->data, t1->length, &tm1, t1->type) == -1)
  274. +	if (ASN1_time_parse((char *)t1->data, t1->length, &tm1, t1->type) == -1)
  275.  		return -2;
  276.  
  277. -	if (ASN1_time_parse(t2->data, t2->length, &tm2, t2->type) == -1)
  278. +	if (ASN1_time_parse((char *)t2->data, t2->length, &tm2, t2->type) == -1)
  279.  		return -2;
  280.  
  281.  	return ASN1_time_tm_cmp(&tm1, &tm2);
  282. @@ -511,7 +512,7 @@ ASN1_UTCTIME_check(const ASN1_UTCTIME *d)
  283.  {
  284.  	if (d->type != V_ASN1_UTCTIME)
  285.  		return 0;
  286. -	return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
  287. +	return d->type == ASN1_time_parse((char *)d->data, d->length, NULL, d->type);
  288.  }
  289.  LCRYPTO_ALIAS(ASN1_UTCTIME_check);
  290.  
  291. @@ -557,7 +558,8 @@ ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *d)
  292.  {
  293.  	if (d->type != V_ASN1_GENERALIZEDTIME)
  294.  		return 0;
  295. -	return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
  296. +	return d->type == ASN1_time_parse((char *)d->data, d->length, NULL,
  297. +	    d->type);
  298.  }
  299.  LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_check);
  300.  
  301. diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c
  302. index 3f673205c..40b09dc23 100644
  303. --- a/crypto/bio/b_dump.c
  304. +++ b/crypto/bio/b_dump.c
  305. @@ -86,7 +86,7 @@ BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
  306.  
  307.  	if (len < 0)
  308.  		goto err;
  309. -	CBS_init(&cbs, s, len);
  310. +	CBS_init(&cbs, (uint8_t *)s, len);
  311.  
  312.  	if (indent < 0)
  313.  		indent = 0;
  314. diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
  315. index 0fa6317a2..afcd6b216 100644
  316. --- a/crypto/bio/bss_mem.c
  317. +++ b/crypto/bio/bss_mem.c
  318. @@ -84,7 +84,7 @@ bio_mem_pending(struct bio_mem *bm)
  319.  static uint8_t *
  320.  bio_mem_read_ptr(struct bio_mem *bm)
  321.  {
  322. -	return &bm->buf->data[bm->read_offset];
  323. +	return (uint8_t *)&bm->buf->data[bm->read_offset];
  324.  }
  325.  
  326.  static int mem_new(BIO *bio);
  327. @@ -349,7 +349,7 @@ mem_gets(BIO *bio, char *out, int out_len)
  328.  		return 0;
  329.  	}
  330.  
  331. -	p = bio_mem_read_ptr(bm);
  332. +	p = (char *)bio_mem_read_ptr(bm);
  333.  	for (i = 0; i < out_max; i++) {
  334.  		if (p[i] == '\n') {
  335.  			i++;
  336. diff --git a/crypto/bn/bn_convert.c b/crypto/bn/bn_convert.c
  337. index ab5bc519c..cb006a209 100644
  338. --- a/crypto/bn/bn_convert.c
  339. +++ b/crypto/bn/bn_convert.c
  340. @@ -261,7 +261,7 @@ BN_asc2bn(BIGNUM **bnp, const char *s)
  341.  	if ((s_len = strlen(s)) == 0)
  342.  		return 0;
  343.  
  344. -	CBS_init(&cbs, s, s_len);
  345. +	CBS_init(&cbs, (uint8_t *)s, s_len);
  346.  
  347.  	/* Handle negative sign. */
  348.  	if (!CBS_peek_u8(&cbs, &v))
  349. @@ -373,7 +373,7 @@ BN_bn2dec(const BIGNUM *bn)
  350.  	CBB_cleanup(&cbb);
  351.  	freezero(data, data_len);
  352.  
  353. -	return s;
  354. +	return (char *)s;
  355.  }
  356.  LCRYPTO_ALIAS(BN_bn2dec);
  357.  
  358. @@ -476,7 +476,7 @@ BN_dec2bn(BIGNUM **bnp, const char *s)
  359.  	if ((s_len = strlen(s)) == 0)
  360.  		return 0;
  361.  
  362. -	CBS_init(&cbs, s, s_len);
  363. +	CBS_init(&cbs, (uint8_t *)s, s_len);
  364.  
  365.  	return bn_dec2bn_cbs(bnp, &cbs);
  366.  }
  367. @@ -677,7 +677,7 @@ BN_hex2bn(BIGNUM **bnp, const char *s)
  368.  	if ((s_len = strlen(s)) == 0)
  369.  		return 0;
  370.  
  371. -	CBS_init(&cbs, s, s_len);
  372. +	CBS_init(&cbs, (uint8_t *)s, s_len);
  373.  
  374.  	return bn_hex2bn_cbs(bnp, &cbs);
  375.  }
  376. diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
  377. index cd8b66360..655732413 100644
  378. --- a/crypto/bn/bn_print.c
  379. +++ b/crypto/bn/bn_print.c
  380. @@ -82,7 +82,7 @@ bn_print_bignum(BIO *bio, const BIGNUM *bn, int indent)
  381.  	if (!bn_bn2hex_nosign(bn, &hex, &hex_len))
  382.  		goto err;
  383.  
  384. -	CBS_init(&cbs, hex, hex_len);
  385. +	CBS_init(&cbs, (uint8_t *)hex, hex_len);
  386.  
  387.  	if (BN_is_negative(bn)) {
  388.  		if (BIO_printf(bio, " (Negative)") <= 0)
  389. diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c
  390. index cde2f6c64..9f8b13ed1 100644
  391. --- a/crypto/evp/e_sm4.c
  392. +++ b/crypto/evp/e_sm4.c
  393. @@ -237,9 +237,11 @@ sm4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
  394.      size_t len)
  395.  {
  396.  	EVP_SM4_KEY *key = ((EVP_SM4_KEY *)(ctx)->cipher_data);
  397. +	unsigned int num;
  398.  
  399.  	CRYPTO_ctr128_encrypt(in, out, len, &key->ks, ctx->iv, ctx->buf,
  400. -	    &ctx->num, (block128_f)SM4_encrypt);
  401. +	    &num, (block128_f)SM4_encrypt);
  402. +	ctx->num = num;
  403.  	return 1;
  404.  }
  405.  
  406. diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
  407. index 460c1bce5..15a70b1c5 100644
  408. --- a/crypto/ocsp/ocsp_cl.c
  409. +++ b/crypto/ocsp/ocsp_cl.c
  410. @@ -410,7 +410,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
  411.  	 * (such as UTCTIME permitted/required by RFC 5280 for certificates)
  412.  	 */
  413.  	/* Check that thisUpdate is valid. */
  414. -	if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this,
  415. +	if (ASN1_time_parse((char *)thisupd->data, thisupd->length, &tm_this,
  416.  	    V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
  417.  		OCSPerror(OCSP_R_ERROR_IN_THISUPDATE_FIELD);
  418.  		return 0;
  419. @@ -433,7 +433,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
  420.  		return 1;
  421.  
  422.  	/* Check that nextUpdate is valid. */
  423. -	if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next,
  424. +	if (ASN1_time_parse((char *)nextupd->data, nextupd->length, &tm_next,
  425.  	    V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
  426.  		OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
  427.  		return 0;
  428. diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
  429. index f2e17806d..cb6b2e84f 100644
  430. --- a/crypto/pkcs7/pk7_attr.c
  431. +++ b/crypto/pkcs7/pk7_attr.c
  432. @@ -192,7 +192,7 @@ PKCS7_add0_attrib_signing_time(PKCS7_SIGNER_INFO *si, ASN1_TIME *t)
  433.  	}
  434.  
  435.  	/* RFC 5652, section 11.3 - UTCTime for the years 1950-2049. */
  436. -	if (ASN1_time_parse(tm->data, tm->length, NULL, tm->type) == -1)
  437. +	if (ASN1_time_parse((char *)tm->data, tm->length, NULL, tm->type) == -1)
  438.  		goto err;
  439.  	if (!PKCS7_add_signed_attribute(si, NID_pkcs9_signingTime, tm->type, tm))
  440.  		goto err;
  441. diff --git a/crypto/x509/x509_addr.c b/crypto/x509/x509_addr.c
  442. index b4ee92a14..615375dd6 100644
  443. --- a/crypto/x509/x509_addr.c
  444. +++ b/crypto/x509/x509_addr.c
  445. @@ -1875,7 +1875,7 @@ addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
  446.  	X509 *cert = NULL;
  447.  	int depth = -1;
  448.  	int i;
  449. -	unsigned int length;
  450. +	int length;
  451.  	int ret = 1;
  452.  
  453.  	/* We need a non-empty chain to test against. */
  454. diff --git a/crypto/x509/x509_constraints.c b/crypto/x509/x509_constraints.c
  455. index c4f32c9cf..597fdde06 100644
  456. --- a/crypto/x509/x509_constraints.c
  457. +++ b/crypto/x509/x509_constraints.c
  458. @@ -347,7 +347,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
  459.  
  460.  	for (i = 0; i < len; i++) {
  461.  		char c;
  462. -		if (!CBS_get_u8(&copy, &c))
  463. +		if (!CBS_get_u8(&copy, (uint8_t *)&c))
  464.  			goto bad;
  465.  		/* non ascii, cr, lf, or nul is never allowed */
  466.  		if (!isascii(c) || c == '\r' || c == '\n' || c == '\0')
  467. @@ -445,7 +445,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
  468.  	}
  469.  	if (candidate_local == NULL || candidate_domain == NULL)
  470.  		goto bad;
  471. -	CBS_init(&domain_cbs, candidate_domain, strlen(candidate_domain));
  472. +	CBS_init(&domain_cbs, (uint8_t *)candidate_domain, strlen(candidate_domain));
  473.  	if (!x509_constraints_valid_host(&domain_cbs, 0))
  474.  		goto bad;
  475.  
  476. @@ -549,7 +549,7 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
  477.  			if (host != NULL)
  478.  				break;
  479.  			/* start after the userinfo part */
  480. -			host = uri + i + 1;
  481. +			host = (char *)uri + i + 1;
  482.  			continue;
  483.  		}
  484.  		/* did we find the end? */
  485. @@ -561,8 +561,8 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
  486.  	if (hostlen == 0)
  487.  		return 0;
  488.  	if (host == NULL)
  489. -		host = authority;
  490. -	CBS_init(&host_cbs, host, hostlen);
  491. +		host = (char *)authority;
  492. +	CBS_init(&host_cbs, (uint8_t *)host, hostlen);
  493.  	if (!x509_constraints_valid_host(&host_cbs, 1))
  494.  		return 0;
  495.  	if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
  496. @@ -667,8 +667,8 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
  497.  		*error = X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX;
  498.  		goto err;
  499.  	}
  500. -	ret = x509_constraints_domain(hostpart, strlen(hostpart), constraint,
  501. -	    len);
  502. +	ret = x509_constraints_domain(hostpart, strlen(hostpart),
  503. +	    (char *)constraint, len);
  504.   err:
  505.  	free(hostpart);
  506.  	return ret;
  507. @@ -1018,7 +1018,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
  508.  	case GEN_DNS:
  509.  		if (!x509_constraints_valid_domain_constraint(&cbs))
  510.  			goto err;
  511. -		if ((name->name = strndup(bytes, len)) == NULL) {
  512. +		if ((name->name = strndup((char *)bytes, len)) == NULL) {
  513.  			error = X509_V_ERR_OUT_OF_MEM;
  514.  			goto err;
  515.  		}
  516. @@ -1064,7 +1064,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
  517.  	case GEN_URI:
  518.  		if (!x509_constraints_valid_domain_constraint(&cbs))
  519.  			goto err;
  520. -		if ((name->name = strndup(bytes, len)) == NULL) {
  521. +		if ((name->name = strndup((char *)bytes, len)) == NULL) {
  522.  			error = X509_V_ERR_OUT_OF_MEM;
  523.  			goto err;
  524.  		}
  525. diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c
  526. index db1741cc9..43afeb8cf 100644
  527. --- a/crypto/x509/x509_obj.c
  528. +++ b/crypto/x509/x509_obj.c
  529. @@ -78,13 +78,13 @@ X509_NAME_ENTRY_add_object_cbb(CBB *cbb, const ASN1_OBJECT *aobj)
  530.  	/* Prefer SN over LN, and fall back to textual representation of OID. */
  531.  	if ((nid = OBJ_obj2nid(aobj)) != NID_undef) {
  532.  		if ((str = OBJ_nid2sn(nid)) != NULL)
  533. -			return CBB_add_bytes(cbb, str, strlen(str));
  534. +			return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
  535.  		if ((str = OBJ_nid2ln(nid)) != NULL)
  536. -			return CBB_add_bytes(cbb, str, strlen(str));
  537. +			return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
  538.  	}
  539.  	if (OBJ_obj2txt(buf, sizeof(buf), aobj, 1) == 0)
  540.  		return 0;
  541. -	return CBB_add_bytes(cbb, buf, strlen(buf));
  542. +	return CBB_add_bytes(cbb, (uint8_t *)buf, strlen(buf));
  543.  }
  544.  
  545.  static int
  546. @@ -183,9 +183,9 @@ X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
  547.  		goto err;
  548.  
  549.  	if (buf == NULL)
  550. -		return line;
  551. +		return (char *)line;
  552.  
  553. -	strlcpy(buf, line, len);
  554. +	strlcpy(buf, (char *)line, len);
  555.  	free(line);
  556.  
  557.  	return buf;
  558. diff --git a/crypto/x509/x509_utl.c b/crypto/x509/x509_utl.c
  559. index 2e60834ed..0746ac0c5 100644
  560. --- a/crypto/x509/x509_utl.c
  561. +++ b/crypto/x509/x509_utl.c
  562. @@ -504,7 +504,7 @@ hex_to_string(const unsigned char *buffer, long len)
  563.   err:
  564.  	CBB_cleanup(&cbb);
  565.  
  566. -	return out;
  567. +	return (char *)out;
  568.  }
  569.  LCRYPTO_ALIAS(hex_to_string);
  570.  
  571. @@ -569,7 +569,7 @@ string_to_hex(const char *str, long *len)
  572.  		goto err;
  573.  	}
  574.  
  575. -	CBS_init(&cbs, str, strlen(str));
  576. +	CBS_init(&cbs, (uint8_t *)str, strlen(str));
  577.  	while (CBS_len(&cbs) > 0) {
  578.  		/*
  579.  		 * Skipping only a single colon between two pairs of digits
  580. @@ -813,7 +813,7 @@ equal_nocase(const unsigned char *pattern, size_t pattern_len,
  581.  	skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
  582.  	if (pattern_len != subject_len)
  583.  		return 0;
  584. -	return (strncasecmp(pattern, subject, pattern_len) == 0);
  585. +	return (strncasecmp((char *)pattern, (char *)subject, pattern_len) == 0);
  586.  }
  587.  
  588.  /* Compare using strncmp. */
  589. @@ -828,7 +828,7 @@ equal_case(const unsigned char *pattern, size_t pattern_len,
  590.  	skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
  591.  	if (pattern_len != subject_len)
  592.  		return 0;
  593. -	return (strncmp(pattern, subject, pattern_len) == 0);
  594. +	return (strncmp((char *)pattern, (char *)subject, pattern_len) == 0);
  595.  }
  596.  
  597.  /*
  598. diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
  599. index fc3fbc14d..95c6cf359 100644
  600. --- a/crypto/x509/x509_verify.c
  601. +++ b/crypto/x509/x509_verify.c
  602. @@ -55,7 +55,8 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
  603.  	if (atime == NULL)
  604.  		return 0;
  605.  
  606. -	type = ASN1_time_parse(atime->data, atime->length, &tm, atime->type);
  607. +	type = ASN1_time_parse((char *)atime->data, atime->length, &tm,
  608. +	    atime->type);
  609.  	if (type == -1)
  610.  		return 0;
  611.  
  612. diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
  613. index e60d8b7a3..5fc4d2ee0 100644
  614. --- a/crypto/x509/x509name.c
  615. +++ b/crypto/x509/x509name.c
  616. @@ -107,7 +107,8 @@ X509_NAME_get_text_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, char *buf,
  617.  		goto err;
  618.  	/* We still support the "pass NULL to find out how much" API */
  619.  	if (buf != NULL) {
  620. -		if (len <= 0 || !CBS_write_bytes(&cbs, buf, len - 1, NULL))
  621. +		if (len <= 0 || !CBS_write_bytes(&cbs, (uint8_t *)buf,
  622. +		    len - 1, NULL))
  623.  			goto err;
  624.  		/* It must be a C string */
  625.  		buf[text_len] = '\0';
  626. diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
  627. index bcf26bec4..431af32f2 100644
  628. --- a/ssl/s3_lib.c
  629. +++ b/ssl/s3_lib.c
  630. @@ -1551,7 +1551,7 @@ _SSL_set_tlsext_host_name(SSL *s, const char *name)
  631.  	if (name == NULL)
  632.  		return 1;
  633.  
  634. -	CBS_init(&cbs, name, strlen(name));
  635. +	CBS_init(&cbs, (uint8_t *)name, strlen(name));
  636.  
  637.  	if (!tlsext_sni_is_valid_hostname(&cbs, &is_ip)) {
  638.  		SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
  639. diff --git a/ssl/ssl_clnt.c b/ssl/ssl_clnt.c
  640. index 6ef81a170..ffc55e5f9 100644
  641. --- a/ssl/ssl_clnt.c
  642. +++ b/ssl/ssl_clnt.c
  643. @@ -2337,7 +2337,7 @@ ssl3_send_client_change_cipher_spec(SSL *s)
  644.  	memset(&cbb, 0, sizeof(cbb));
  645.  
  646.  	if (s->s3->hs.state == SSL3_ST_CW_CHANGE_A) {
  647. -		if (!CBB_init_fixed(&cbb, s->init_buf->data,
  648. +		if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
  649.  		    s->init_buf->length))
  650.  			goto err;
  651.  		if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
  652. diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
  653. index 630724e67..32ab5332a 100644
  654. --- a/ssl/ssl_lib.c
  655. +++ b/ssl/ssl_lib.c
  656. @@ -2004,12 +2004,12 @@ SSL_export_keying_material(SSL *s, unsigned char *out, size_t out_len,
  657.  			context = NULL;
  658.  			context_len = 0;
  659.  		}
  660. -		return tls13_exporter(s->tls13, label, label_len, context,
  661. -		    context_len, out, out_len);
  662. +		return tls13_exporter(s->tls13, (uint8_t *)label, label_len,
  663. +		    context, context_len, out, out_len);
  664.  	}
  665.  
  666. -	return tls12_exporter(s, label, label_len, context, context_len,
  667. -	    use_context, out, out_len);
  668. +	return tls12_exporter(s, (uint8_t *)label, label_len, context,
  669. +	    context_len, use_context, out, out_len);
  670.  }
  671.  LSSL_ALIAS(SSL_export_keying_material);
  672.  
  673. diff --git a/ssl/ssl_srvr.c b/ssl/ssl_srvr.c
  674. index af4b20f6c..e877bb3f9 100644
  675. --- a/ssl/ssl_srvr.c
  676. +++ b/ssl/ssl_srvr.c
  677. @@ -2378,7 +2378,7 @@ ssl3_send_server_change_cipher_spec(SSL *s)
  678.  	memset(&cbb, 0, sizeof(cbb));
  679.  
  680.  	if (s->s3->hs.state == SSL3_ST_SW_CHANGE_A) {
  681. -		if (!CBB_init_fixed(&cbb, s->init_buf->data,
  682. +		if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
  683.  		    s->init_buf->length))
  684.  			goto err;
  685.  		if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
  686. diff --git a/ssl/ssl_tlsext.c b/ssl/ssl_tlsext.c
  687. index d879b3304..2b75b0fbb 100644
  688. --- a/ssl/ssl_tlsext.c
  689. +++ b/ssl/ssl_tlsext.c
  690. @@ -808,7 +808,8 @@ tlsext_sni_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
  691.  			*alert = SSL_AD_UNRECOGNIZED_NAME;
  692.  			goto err;
  693.  		}
  694. -		if (!CBS_mem_equal(&host_name, s->session->tlsext_hostname,
  695. +		if (!CBS_mem_equal(&host_name,
  696. +		    (uint8_t *)s->session->tlsext_hostname,
  697.  		    strlen(s->session->tlsext_hostname))) {
  698.  			*alert = SSL_AD_UNRECOGNIZED_NAME;
  699.  			goto err;
  700. diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
  701. index 4ed76c95a..1ad3b9255 100644
  702. --- a/ssl/ssl_txt.c
  703. +++ b/ssl/ssl_txt.c
  704. @@ -170,8 +170,8 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
  705.  	if (x->tlsext_tick != NULL) {
  706.  		if (BIO_puts(bp, "\n    TLS session ticket:\n") <= 0)
  707.  			goto err;
  708. -		if (BIO_dump_indent(bp, x->tlsext_tick, x->tlsext_ticklen,
  709. -		    4) <= 0)
  710. +		if (BIO_dump_indent(bp, (char *)x->tlsext_tick,
  711. +		    x->tlsext_ticklen, 4) <= 0)
  712.  			goto err;
  713.  	}
  714.  
  715. diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
  716. index 912bea592..c93107383 100644
  717. --- a/ssl/t1_lib.c
  718. +++ b/ssl/t1_lib.c
  719. @@ -1014,6 +1014,7 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
  720.  	EVP_CIPHER_CTX *cctx = NULL;
  721.  	SSL_CTX *tctx = s->initial_ctx;
  722.  	int slen, hlen, iv_len;
  723. +	unsigned int hlenu;
  724.  	int alert_desc = SSL_AD_INTERNAL_ERROR;
  725.  	int ret = TLS1_TICKET_FATAL_ERROR;
  726.  
  727. @@ -1108,8 +1109,9 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
  728.  	if (HMAC_Update(hctx, CBS_data(&ticket_encdata),
  729.  	    CBS_len(&ticket_encdata)) <= 0)
  730.  		goto err;
  731. -	if (HMAC_Final(hctx, hmac, &hlen) <= 0)
  732. +	if (HMAC_Final(hctx, hmac, &hlenu) <= 0)
  733.  		goto err;
  734. +	hlen = hlenu;
  735.  
  736.  	if (!CBS_mem_equal(&ticket_hmac, hmac, hlen))
  737.  		goto derr;
  738. diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
  739. index 21d396079..a837b85fe 100644
  740. --- a/ssl/tls13_client.c
  741. +++ b/ssl/tls13_client.c
  742. @@ -668,7 +668,7 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
  743.  	    sizeof(tls13_cert_verify_pad)))
  744.  		goto err;
  745.  	if (!CBB_add_bytes(&cbb, tls13_cert_server_verify_context,
  746. -	    strlen(tls13_cert_server_verify_context)))
  747. +	    strlen((char *)tls13_cert_server_verify_context)))
  748.  		goto err;
  749.  	if (!CBB_add_u8(&cbb, 0))
  750.  		goto err;
  751. @@ -722,7 +722,7 @@ int
  752.  tls13_server_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
  753.  {
  754.  	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
  755. -	struct tls13_secret context = { .data = "", .len = 0 };
  756. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  757.  	struct tls13_secret finished_key;
  758.  	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
  759.  	size_t transcript_hash_len;
  760. @@ -944,7 +944,7 @@ tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
  761.  	    sizeof(tls13_cert_verify_pad)))
  762.  		goto err;
  763.  	if (!CBB_add_bytes(&sig_cbb, tls13_cert_client_verify_context,
  764. -	    strlen(tls13_cert_client_verify_context)))
  765. +	    strlen((char *)tls13_cert_client_verify_context)))
  766.  		goto err;
  767.  	if (!CBB_add_u8(&sig_cbb, 0))
  768.  		goto err;
  769. @@ -1005,7 +1005,7 @@ int
  770.  tls13_client_finished_send(struct tls13_ctx *ctx, CBB *cbb)
  771.  {
  772.  	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
  773. -	struct tls13_secret context = { .data = "", .len = 0 };
  774. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  775.  	struct tls13_secret finished_key = { .data = NULL, .len = 0 };
  776.  	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
  777.  	size_t transcript_hash_len;
  778. diff --git a/ssl/tls13_key_schedule.c b/ssl/tls13_key_schedule.c
  779. index 05bcf0f00..19afc7999 100644
  780. --- a/ssl/tls13_key_schedule.c
  781. +++ b/ssl/tls13_key_schedule.c
  782. @@ -160,8 +160,8 @@ tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
  783.      const struct tls13_secret *secret, const char *label,
  784.      const struct tls13_secret *context)
  785.  {
  786. -	return tls13_hkdf_expand_label_with_length(out, digest, secret, label,
  787. -	    strlen(label), context);
  788. +	return tls13_hkdf_expand_label_with_length(out, digest, secret,
  789. +	    (uint8_t *)label, strlen(label), context);
  790.  }
  791.  
  792.  int
  793. @@ -185,7 +185,7 @@ tls13_hkdf_expand_label_with_length(struct tls13_secret *out,
  794.  		goto err;
  795.  	if (!CBB_add_u8_length_prefixed(&cbb, &child))
  796.  		goto err;
  797. -	if (!CBB_add_bytes(&child, tls13_plabel, strlen(tls13_plabel)))
  798. +	if (!CBB_add_bytes(&child, (uint8_t *)tls13_plabel, strlen(tls13_plabel)))
  799.  		goto err;
  800.  	if (!CBB_add_bytes(&child, label, label_len))
  801.  		goto err;
  802. @@ -362,7 +362,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets,
  803.  int
  804.  tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
  805.  {
  806. -	struct tls13_secret context = { .data = "", .len = 0 };
  807. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  808.  
  809.  	if (!secrets->init_done || !secrets->early_done ||
  810.  	    !secrets->handshake_done || !secrets->schedule_done)
  811. @@ -376,7 +376,7 @@ tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
  812.  int
  813.  tls13_update_server_traffic_secret(struct tls13_secrets *secrets)
  814.  {
  815. -	struct tls13_secret context = { .data = "", .len = 0 };
  816. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  817.  
  818.  	if (!secrets->init_done || !secrets->early_done ||
  819.  	    !secrets->handshake_done || !secrets->schedule_done)
  820. @@ -423,7 +423,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
  821.  
  822.  	/* In TLSv1.3 no context is equivalent to an empty context. */
  823.  	if (context_value == NULL) {
  824. -		context_value = "";
  825. +		context_value = (uint8_t *)"";
  826.  		context_value_len = 0;
  827.  	}
  828.  
  829. diff --git a/ssl/tls13_legacy.c b/ssl/tls13_legacy.c
  830. index 6a06330b2..220999745 100644
  831. --- a/ssl/tls13_legacy.c
  832. +++ b/ssl/tls13_legacy.c
  833. @@ -359,7 +359,7 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
  834.  	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
  835.  	if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
  836.  		goto err;
  837. -	if (!CBS_write_bytes(&cbs, s->init_buf->data,
  838. +	if (!CBS_write_bytes(&cbs, (uint8_t *)s->init_buf->data,
  839.  	    s->init_buf->length, NULL))
  840.  		goto err;
  841.  
  842. diff --git a/ssl/tls13_lib.c b/ssl/tls13_lib.c
  843. index c3470b293..5d9f15950 100644
  844. --- a/ssl/tls13_lib.c
  845. +++ b/ssl/tls13_lib.c
  846. @@ -378,7 +378,8 @@ tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
  847.  	uint32_t ticket_lifetime, ticket_age_add;
  848.  	CBS ticket_nonce, ticket;
  849.  	SSL_SESSION *sess = NULL;
  850. -	int alert, session_id_length;
  851. +	int alert;
  852. +	unsigned int session_id_length;
  853.  	ssize_t ret = 0;
  854.  
  855.  	memset(&nonce, 0, sizeof(nonce));
  856. diff --git a/ssl/tls13_record_layer.c b/ssl/tls13_record_layer.c
  857. index f5604adbe..9bdd61c91 100644
  858. --- a/ssl/tls13_record_layer.c
  859. +++ b/ssl/tls13_record_layer.c
  860. @@ -467,7 +467,7 @@ static int
  861.  tls13_record_layer_set_traffic_key(const EVP_AEAD *aead, const EVP_MD *hash,
  862.      struct tls13_record_protection *rp, struct tls13_secret *traffic_key)
  863.  {
  864. -	struct tls13_secret context = { .data = "", .len = 0 };
  865. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  866.  	struct tls13_secret key = { .data = NULL, .len = 0 };
  867.  	int ret = 0;
  868.  
  869. diff --git a/ssl/tls13_server.c b/ssl/tls13_server.c
  870. index 604dab4cb..2beb72636 100644
  871. --- a/ssl/tls13_server.c
  872. +++ b/ssl/tls13_server.c
  873. @@ -728,7 +728,7 @@ tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
  874.  	    sizeof(tls13_cert_verify_pad)))
  875.  		goto err;
  876.  	if (!CBB_add_bytes(&sig_cbb, tls13_cert_server_verify_context,
  877. -	    strlen(tls13_cert_server_verify_context)))
  878. +	    strlen((char *)tls13_cert_server_verify_context)))
  879.  		goto err;
  880.  	if (!CBB_add_u8(&sig_cbb, 0))
  881.  		goto err;
  882. @@ -783,7 +783,7 @@ int
  883.  tls13_server_finished_send(struct tls13_ctx *ctx, CBB *cbb)
  884.  {
  885.  	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
  886. -	struct tls13_secret context = { .data = "", .len = 0 };
  887. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  888.  	struct tls13_secret finished_key = { .data = NULL, .len = 0 } ;
  889.  	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
  890.  	size_t transcript_hash_len;
  891. @@ -840,7 +840,7 @@ int
  892.  tls13_server_finished_sent(struct tls13_ctx *ctx)
  893.  {
  894.  	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
  895. -	struct tls13_secret context = { .data = "", .len = 0 };
  896. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  897.  
  898.  	/*
  899.  	 * Derive application traffic keys.
  900. @@ -959,7 +959,7 @@ tls13_client_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
  901.  	    sizeof(tls13_cert_verify_pad)))
  902.  		goto err;
  903.  	if (!CBB_add_bytes(&cbb, tls13_cert_client_verify_context,
  904. -	    strlen(tls13_cert_client_verify_context)))
  905. +	    strlen((char *)tls13_cert_client_verify_context)))
  906.  		goto err;
  907.  	if (!CBB_add_u8(&cbb, 0))
  908.  		goto err;
  909. @@ -1020,7 +1020,7 @@ int
  910.  tls13_client_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
  911.  {
  912.  	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
  913. -	struct tls13_secret context = { .data = "", .len = 0 };
  914. +	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
  915.  	struct tls13_secret finished_key;
  916.  	uint8_t *verify_data = NULL;
  917.  	size_t verify_data_len;
  918. -- 
  919. 2.49.0